Repository navigation
Bind cached licences to OS credentials and harden offline rollback - #1248
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A copied licence file currently supplies its own expected installation identity, and clock checkpoints do not authenticate or mirror their paid-time watermark. Cached paid access now waits for the real OS installation credential and initial mirror reconciliation, then requires a domain-separated installation-key seal over the whole local record. Unsealed v1/v2 caches retain trial history and the purchase key for online recovery without granting cached paid access.
Minute checkpoints advance authenticated revisions and both stores; same-lease reconciliation keeps the greatest paid-time marker, while a fresh signed server reply can recover from an incorrect forward clock jump. Running expiry and daily renewal scheduling also use monotonic elapsed time. Terminal statuses are mirrored before reporting a completed save; blocked OS writes have a bounded command wait and cannot restore stale state in memory.
Closes #1246; tracks #1217 on v1.4.0. The licence guide explains cold-start credential verification and recovery. docs/licensing-cache.md states the limits: full OS-store/clock rollback and simultaneous failure of all persistence cannot be solved by an offline client.
Validation: prediction models, lint, 323 UI + 23 Node tests, app/docs builds, Rust fmt/clippy, 880 Rust unit + 9 configuration tests passed (4 existing ignored). New regressions cover file-only transplant, tampering, cold locked-store restart/healing, monotonic expiry, authenticated watermark merge, legacy migration and revocation recovery after file-write failure. Tests use fixture keys, fake stores/transports and no native input.
Native installed-app/hardware validation remains pending. No production secrets or deployments changed. Release stays HELD; no merge, version bump, tag, RC or release.
Initial independent review found a startup checkpoint race. Fixed by retaining the original sealed record until identity and mirror reconciliation complete, with locked-startup checkpoint/file-write regressions against empty and stale terminal mirrors. Fresh independent review of 73e2b4d found no actionable issues; the reviewer inspected identity binding, cache seals, clock/reconciliation and terminal persistence. Native acceptance remains pending.